fix #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an...

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 582cf38cb6a81058075c1ee9fbeaecd42211d8c8..2dc28e4c227a81314ea26eab0b7892a37b5f2469 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -6211,6 +6211,12 @@ static void php_simple_ini_parser_cb(zval *arg1, zval *arg2, int callback_type,
                                }
                        }
 
+                       if (Z_TYPE_P(hash) != IS_ARRAY) {
+                               zval_dtor(hash);
+                               INIT_PZVAL(hash);
+                               array_init(hash);
+                       }
+
                        ALLOC_ZVAL(element);
                        *element = *arg2;
                        zval_copy_ctor(element);

diff --git a/ext/standard/tests/general_functions/bug40752.phpt b/ext/standard/tests/general_functions/bug40752.phpt
new file mode 100644 (file)
index 0000000..67daee9
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug40752.phpt
@@ -0,0 +1,50 @@
+--TEST--
+Bug #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an array)
+--FILE--
+<?php
+
+$file = dirname(__FILE__)."/bug40752.ini";
+file_put_contents($file, '
+foo   = 1;
+foo[] = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+file_put_contents($file, '
+foo[] = 1;
+foo   = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+unlink($file);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["foo"]=>
+  string(1) "1"
+}
+Done
+--UEXPECTF--
+array(1) {
+  [u"foo"]=>
+  array(1) {
+    [0]=>
+    unicode(1) "1"
+  }
+}
+array(1) {
+  [u"foo"]=>
+  unicode(1) "1"
+}
+Done